Malwarebytes earned three PCMag wins and achieved 100% protection in AVLab Cybersecurity Foundation’s latest malware test.

Malwarebytes proudly topped three categories in PCMag’s 2025 Readers’ Choice Awards, recognized for exceptional protection and user satisfaction. We also earned the latest badge from AVLab Cybersecurity Foundation’s September “Advanced In-The-Wild Malware Test” by blocking 100% of malware samples. 

Malwarebytes continues to impress, winning the latest PC Mag Readers’ Choice Awards 2025 in multiple categories:  

*   Best PC Security Suite  

*   Best Android Antivirus 

*   Best iOS/iPadOS Antivirus 

PCMag’s Readers’ Choice Awards celebrate the technology brands users trust and love the most, based on real-world feedback from thousands of readers. 

Malwarebytes delivered outstanding performance and earned praise from readers for its **reliability**, **ease of use**, **powerful protection**, and **overall trustworthiness**—scoring more than half a point above competitors and excelling in every subcategory, including ransomware protection, phishing protection, and integrated VPN.  

> _“According to our readers, there’s no better security option for PCs or mobile devices than_ _Malwarebytes__. The software racks up nearly perfect scores in categories like reliability, ease of use, spam filtering, and most importantly, antivirus and malware protection. It’s also trusted more than any other product in the rankings.”__\*_ 

Continuing our streak of excellence, Malwarebytes also received the latest badge in AVLab Cybersecurity Foundation’s “Advanced In-The-Wild” series, following our earlier 2025 Product of the Year award—our third consecutive win. 

In September, AVLab Cybersecurity Foundation tested 443 unique malware samples against 18 cybersecurity products. Malwarebytes Premium Security detected all 443, with an average remediation time of 8.4 seconds—almost 8 seconds faster than the industry average.  

These results highlight our mission to reimagine security and protect people and data across all devices and platforms. 

Recent innovations like Malwarebytes Scam Guard for Mobile and Windows Tools for PC set new standards for privacy and affordable protection, enhanced by AI-powered features like Trusted Advisor, your built-in personal digital health hub available on all platforms. 

Malwarebytes is proud to receive both awards, and we thank PCMag readers and the AVLab Cybersecurity Foundation for their trust and recognition. 

_\*Reprinted with permission. (c) 2025 Ziff Davis, LLC. All Rights Reserved._

 Malwarebytes aces PCMag Readers’ Choice Awards and AVLab Cybersecurity Foundation tests 

A list of topics we covered in the week of October 27 to November 2 of 2025

October 31, 2025 - Google’s latest Chrome release fixes seven serious flaws that could let attackers run malicious code just by luring you to a compromised page.

October 30, 2025 - Attackers don’t need to hack you to find you. They just piece together what’s already public.

October 30, 2025 - You could be one of more than 10 million people caught up in its recent data breach. Here's what to watch out for.

October 30, 2025 - Tina Pal wants a word about your PayPal account—but it's a scam. Here’s how to spot the red flags and what to do if you’ve already called.

October 29, 2025 - By blending search and chat in one field, OpenAI’s Atlas has made browsing more convenient—and more dangerous.

 A week in security (October 27 &#8211; November 2) 

Google’s latest Chrome release fixes seven serious flaws that could let attackers run malicious code just by luring you to a compromised page.

Google has released an update for its Chrome browser that includes 20 security fixes, several of which are classed as high severity. Most of these flaws were found in Chrome’s V8 engine—the part of Chrome (and other Chromium-based browsers) that runs JavaScript.

Chrome is by far the world’s most popular browser, used by an estimated 3.4 billion people. That scale means when Chrome has a security flaw, billions of users are potentially exposed until they update.

These vulnerabilities are serious because they affect the code that runs almost every website you visit. Every time you load a page, your browser executes JavaScript from all sorts of sources, whether you notice it or not. Without proper safety checks, attackers can sneak in malicious instructions that your browser then runs—sometimes without you clicking anything. That could lead to stolen data, malware infections, or even a full system compromise.

That’s why it’s important to install these patches promptly. Staying unpatched means you could be open to an attack just by browsing the web, and attackers often exploit these kinds of flaws before most users have a chance to update. Always let your browser update itself, and don’t delay restarting to apply security patches, because updates often fix exactly this kind of risk.

**How to update**

The Chrome update brings the version number to 142.0.7444.59/.60 for Windows, 142.0.7444.60 for MacOS and 142.0.7444.59 for Linux. So, if your Chrome is on the version number **142.0.7444.59 or later,** it’s protected from these vulnerabilities.

The easiest way to update is to allow Chrome to update automatically, but you can end up lagging behind if you never close your browser or if something goes wrong—such as an extension stopping you from updating the browser.

To update manually, click the “**More**” menu (three stacked dots), then choose **Settings** > **About Chrome**. If there is an update available, Chrome will notify you and start downloading it. Then relaunch Chrome to complete the update, and you’ll be protected against these vulnerabilities.

You can find more detailed update instructions and how to read the version number in our article on how to update Chrome on every operating system.

**Technical details**

Among the vulnerabilities in the V8 engine there are two that stand out:

**CVE-2025-12428** is a high-severity “type confusion” vulnerability in the V8 JavaScript engine. This happens when code doesn’t verify the object type it’s handling and then uses it incorrectly. In other words, the software mistakes one type of data for another—like treating a list as a single value or a number as text. This can cause Chrome to behave unpredictably and, in some cases, let attackers manipulate memory and execute code remotely through crafted JavaScript on a malicious or compromised website. Google paid a $50,000 bounty for its discovery, highlighting its severity.

**CVE-2025-12036** involves an inappropriate implementation in V8 and is classified as critical. This one allows remote code execution (RCE)—meaning an attacker could run code on your computer just by getting you to visit a specially crafted page. Google’s Big Sleep project, an AI-driven system that automates vulnerability discovery, found the flaw. It stems from improper handling in the internals of the JavaScript and WebAssembly engines and carries a high risk of data theft, malware installation, or even full system compromise.

Users of other Chromium-based browsers—like Edge, Opera, and Brave—can expect similar updates in the near future.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 Update Chrome now: 20 security fixes just landed 

Attackers don’t need to hack you to find you. They just piece together what’s already public.

Think of your digital footprint as your online shadow—the trail you leave behind whenever you browse, post, shop, or even appear in someone’s contact list. It’s your likes, reviews, comments, and all the little traces you didn’t mean to share. Together, they paint a picture of you—one that friends, employers, and yes, scammers can see.

**Step 1:  Your active footprint**

Your **active footprint** is everything you choose to share online. Every photo, product review, or status update you post adds another brushstroke to your online portrait. Over time, those choices form a public story about who you are—your interests, values, and connections. That story shapes how people, employers, and even algorithms see you.

**Step 2: Your passive footprint**

Your **passive footprint** is the quieter one—the data you leave behind without meaning to. Every website you visit, every cookie that tracks your clicks, every photo that quietly tags its GPS location adds to it. These fragments often work in the background, invisible but persistent, quietly mapping your habits, preferences, and even your movements.

**You step in more stuff than you think**

Your personal data is scattered in more places than you’d expect. Social networks like Facebook, LinkedIn, and TikTok hold snapshots of your life and relationships. Government databases, company websites, and news mentions might hold your name or location. Forums, review sites, and shopping accounts keep their own records. And data brokers collect and sell huge bundles of personal details, sometimes packaging them into lists anyone can buy. Even if you’ve never shared something directly, chances are it’s already out there.

Alone, small details don’t seem like much—a nickname here, a photo there—but stitched together they can reveal a lot. Your job title, home city, favorite restaurant, even your pet’s name (a popular security question!) can help someone impersonate or target you. Combine that with info leaked in data breaches, and attackers can build an eerily complete version of you—ready-made for scams or identity theft.

To stay safe, it helps to see the world the way a scammer does: your online details are puzzle pieces, and they’re putting the picture together.

**Scraping**

Attackers use automated tools to pull information from public pages across the internet. That can include your bio, job history, or photos from social media, or your name and email address from company websites and online forums. All technically “public,” but when combined, they create a full dossier of your online life.

**Breaches**

When companies get hacked or fail to secure their databases, your data can spill into the open. Big names like Equifax, LinkedIn, and Yahoo have all been hit. Leaks like these often contain names, addresses, phone numbers, and passwords—and once data hits the dark web, it can circulate for years. That’s why old breaches can still come back to haunt you.

**Brokers**

Data brokers legally collect information from public records and commercial sources, then sell detailed profiles for advertising and risk scoring. On the dark web, things get murkier: stolen logins, payment info, and even full identity kits (“fullz”) are traded by criminals. You’ll never meet these markets—but your data might end up there anyway.

**Social engineering**

Social engineering is where information meets manipulation. Attackers blend the details they find—your social posts, work info, or breached credentials—to make scams feel real. They might impersonate your boss, your bank, or even _you_. These scams work because they sound familiar, borrowing the tone and timing of real interactions.

Here are just a few examples of how personal content shared online—even casually or lovingly—can be reused in ways you’d never imagine.

****AI voice scams that sound heartbreakingly real****

When a mother in the US received a call from her daughter saying she’d been in a car accident and needed bail money, she didn’t hesitate to help. The voice on the other end sounded exactly like her, but it wasn’t. It was an AI-generated clone.

Scammers don’t need much to pull this off—just a few seconds of clear speech. That could come from a TikTok clip, a podcast snippet, a YouTube video, or even a Facebook post where your child’s voice can be heard in the background. Once they have that audio, AI tools can replicate tone, emotion, and phrasing so accurately that even family members struggle to tell the difference.

****The Facebook photo that gives away your location****

You don’t need to tag your location for someone to find you. A recent Malwarebytes investigation showed how AI can now identify where a photo was taken just from the background—down to the street, storefront, or skyline. That means every sunny brunch pic or family snapshot on Facebook could quietly reveal where you live, work, or spend time.

Attackers can use this information to craft more convincing local scams—pretending to be from nearby businesses, schools, or community groups to earn your trust. It’s a sharp reminder that even innocent photos can expose more than you intend.

****When scammers know just enough to sound official****

Earlier this year, Californians were hit with a wave of fake tax refund texts and emails. The messages looked convincing—complete with government logos, correct refund amounts, and links to realistic-looking sites. But the senders weren’t tax officials. They were scammers who had pieced together public and leaked data to make their messages sound real.

That data can come from anywhere—a tagged post that shows you live in California, a LinkedIn page that lists your workplace, or a data broker that sells demographic info. When combined, these fragments let criminals target specific regions or groups, making their scams feel personal and timely.

**S – Share less, on your terms**

Tighten privacy settings on your social accounts so only people you trust can see your posts. Avoid oversharing—travel plans, birthdays, and addresses are gold for scammers. And skip those “fun” quizzes and surveys; they’re often data collection traps in disguise.

**A – Arm your logins**

Use a password manager to create strong, unique passwords for every account. Turn on multi-factor authentication (MFA) wherever possible. Avoid using personal details—pets, schools, hobbies—in passwords or security questions.

**F – Find your exposure**

Set up Google Alerts for your name and nicknames to see when new information about you pops up. Run a free scan with Malwarebytes Digital Footprint Portal to find out if your email appears in data breaches, and change affected passwords fast. Many banks and credit cards also offer free identity monitoring—use it.

**E – Evaluate trust**

Treat surprise messages and calls with healthy skepticism, especially if they sound urgent. Verify requests by going directly to official websites or contact numbers. And talk to family about scams—kids and seniors are often the most common targets.

**S – Stay updated**

Keep your software, devices, and apps current. Security updates close the loopholes that criminals love to exploit. Use an up-to-date real-time anti-malware solution with a web protection component—and follow us to stay alert to new scams and major data leaks.

Your digital footprint tells a story, but you don’t need to vanish from the internet, just manage what you leave behind. A few small, consistent habits can keep your online shadow short, sharp, and safely under your control.

**We don’t just report on scams—we help detect them**

Cybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we’ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!

 How scammers use your data to create personalized tricks that work 

A reminder that one supplier’s breach can ripple far, fueling phishing and ID theft long after the news fades.

Even if you’ve never heard of Conduent, you could be one of the many people caught up in its recent data breach. Conduent provides technology services to several US state governments, including Medicaid, child support, and food programs, with the company stating that it “supports approximately 100 million US residents across various government health programs, helping state and federal agencies.”

In a breach notification, Conduent says:

> “On January 13, 2025, we discovered that we were the victim of a cyber incident that impacted a limited portion of our network.”

An investigation found that an unauthorized third party had access to its systems from October 21, 2024, until the intrusion was stopped on discovery.

Breach notification letters will be sent to affected individuals, detailing what personal information was exposed. According to The Record, Conduent said more than 400,000 people in Texas were impacted, with data including Social Security numbers, medical information and health insurance details. Another 76,000 people in Washington, 48,000 in South Carolina, 10,000 in New Hampshire and 378 in Maine were also affected. Conduent has filed additional breach notices in Oregon, Massachusetts, California, and New Hampshire.

The stolen data sets may include:​

*   Names
*   Social Security numbers
*   Dates of birth
*   Medical information
*   Health insurance details

If all of those apply, it’s certainly enough for criminals to commit identity theft.

Ransomware group SafePay reportedly claimed responsibility for the attack and listed Conduent on its leak site.

Image courtesy of Comparitech

SafePay, which emerged in late 2024, threatened to publish or sell stolen data if its demands weren’t met, claiming to have exfiltrated a staggering 8.5 terabytes of files from Conduent’s systems. Though relatively new on the scene, SafePay has quickly built a reputation for large-scale extortion targeting high-profile clients globally.

Breaches like this reinforce the need for robust cybersecurity and incident response in the public sector. For the potentially millions of people affected, stay alert to fraud and identity theft.

****Protecting yourself after a data breach****

If you think you’ve been the victim of this or any other data breach, here are steps you can take to protect yourself:

*   **Check the vendor’s advice.** Every breach is different, so check with the vendor to find out what’s happened and follow any specific advice it offers.
*   **Change your password.** You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA****).** If you can, use a FIDO2-compliant hardware key, laptop, or phone as your second factor. Some forms of 2FA can be phished just as easily as a password, but 2FA that relies on a FIDO2 device can’t be phished.
*   **Watch out for fake vendors.** The thieves may contact you posing as the vendor. Check the company’s website to see if it’s contacting victims and verify the identity of anyone who contacts you using a different communication channel.
*   **Take your time.** Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
*   **Consider not storing your card details**. It’s definitely more convenient to let sites remember your card details, but we highly recommend not storing that information on websites.
*   **Set up identity monitoring**, which alerts you if your personal information is found being traded illegally online and helps you recover after.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 Ransomware gang claims Conduent breach: what you should watch for next 

Tina Pal wants a word about your PayPal account—but it's a scam. Here’s how to spot the red flags and what to do if you’ve already called.

One of our employees received this suspicious email and showed it to me. Although it’s a pretty straightforward attempt to lure targets into calling the scammers, it’s worth writing up because it looks like it was sent out in bulk.

Let’s look at the red flags.

Firstly, the **sender address**:

PayPal doesn’t use Gmail addresses to send invoices, and they also don’t put your address in the blind carbon copy (BCC) field. BCC hides the list of recipients, which is often a sign the email was sent to a large group.

And “Tina Pal” must be Pay’s evil twin—one who doesn’t know it’s customary to address your customers by name rather than “PayPal customer.”

Because the message came from a genuine Gmail address, the authentication results (SPF, DKIM, and DMARC) all pass. That only proves the email wasn’t spoofed and was sent from a legitimate Gmail server, not that it’s actually from PayPal.

The red flag here is that PayPal emails will not come from random Gmail addresses. Official communications come from addresses like service@paypal.com.

The email body itself was empty but came with a randomly named attachment—two red flags in one. PayPal would at least use some branding in the email and never expect their customers to open an attachment.

Here’s what the invoice in the attachment looked like:

> “PayPal Notification:
> 
> Your account has been billed $823.00. The payment will be processed in the next 24 hours. Didn’t make this purchase? Contact PayPal Support right now.”

More red flags:

*   **Urgency:** “The payment will be processed in the next 24 hours” or else the rather large amount of $823 is gone.
*   **Phone number only:** This isn’t how you normally dispute PayPal charges. Genuine PayPal emails direct you to log in to your account or use their online Resolution Center, not to call a number.
*   **Unverified number:** Reverse lookup tools don’t show it as PayPal’s. Scammers often spoof phone numbers or register them under unrelated businesses. An official PayPal support number will appear on PayPal’s website and be recognized by lookup tools.
*   **Brand mismatch:** An invoice comes from the company charging you, not from the payment provider. So, this one should have been branded for Geek Squad or be titled something like “payment notification.”

**What tech support scammers do**

In this type of tech support scam, the target calls the listed number, and the “tech” on the other end asks to remotely log in to their computer to check for “viruses.” They might run a short program to open command prompts and folders, just to scare and distract the victim. Then they’ll ask to install another tool to “fix” things, which will search the computer for anything they can turn into money. Others will sell you fake protection software and bill you for their services. Either way, the result is the same: you’ll be scammed out of a lot of money.

**Safety tips**

The best way to stay safe is to stay informed about the tricks scammers use. Learn to spot the red flags that almost always give away scams and phishing emails, and remember:

*   Do not open unsolicited attachments.
*   Use verified, official ways to contact companies. Don’t call numbers listed in suspicious emails or attachments.
*   Beware of someone wanting to connect to your computer remotely. One of the tech support scammer’s biggest weapons is their ability to connect remotely to their victims. If they do this, they essentially have total access to all of your files and folders.

If you’ve already fallen victim to a tech support scam:

*   **Paid the scammer?** Contact your credit card company or bank and let them know what’s happened. You may also want to file a complaint with the FTC or contact your local law enforcement, depending on your region.
*   **Shared a password?** If you shared your password with a scammer, change it everywhere it’s used. Consider using a password manager and enable 2FA for important accounts.
*   **Scan your system:** If scammers had access to your system, they may have planted a backdoor so they can revisit whenever they feel like it. Malwarebytes can remove these and other software left behind by scammers.
*   **Watch your accounts:** Keep an eye out for unexpected payments or suspicious charges on your credit cards and bank accounts.
*   **Be wary of suspicious emails.** If you’ve fallen for one scam, they may target you again.

Pro tip: **Malwarebytes Scam Guard recognized this email as a scam.** Upload any suspicious text, emails, attachments and other files to ask for its opinion. It’s really very good at recognizing scams.

**We don’t just report on scams—we help detect them**

Cybersecurity risks should never spread beyond a headline. If something looks dodgy to you, check if it’s a scam using Malwarebytes Scam Guard, a feature of our mobile protection products. Submit a screenshot, paste suspicious content, or share a text or phone number, and we’ll tell you if it’s a scam or legit. Download Malwarebytes Mobile Security for iOS or Android and try it today!

 Fake PayPal invoice from Geek Squad is a tech support scam 

By blending search and chat in one field, OpenAI’s Atlas has made browsing more convenient—and more dangerous.

It seems that with every new agentic browser we discover yet another way to abuse one.

OpenAI recently introduced a ChatGPT based AI browser called Atlas. It didn’t take researchers long to find that the combined search and prompt bar—called the Omnibox—can be exploited.

By pasting a specially crafted link into the Omnibox, attackers can trick Atlas into treating the entire input as a trusted user prompt instead of a URL. That bypasses many safety checks and allows injected instructions to be run with elevated trust.

Artificial Intelligence (AI) browsers are gaining traction, which means we may need to start worrying about the potential dangers of something called “prompt injection.” We’ve discussed the dangers of prompt injection before, but the bottom line is simple: when you give your browser the power to act on your behalf, you also give criminals the chance to abuse that trust.

As researchers at Brave noted:

> “AI-powered browsers that can take actions on your behalf are powerful yet extremely risky. If you’re signed into sensitive accounts like your bank or your email provider in your browser, simply summarizing a {specially fabricated} Reddit post could result in an attacker being able to steal money or your private data.”

Axios reports that Atlas’s dual-purpose Omnibox opens fresh privacy and security risks for users. That’s the downside of combining too much functionality without strong guardrails. But when new features take priority over user security and privacy, those guardrails get overlooked.

Despite researchers demonstrating vulnerabilities, OpenAI claims to have implemented protections to prevent any real dangers. According to its help page:

> “Agent mode runs also operates under boundaries:
> 
> System access: Cannot run code in the browser, download files, or install extensions.
> 
> Data access: Cannot access other apps on your computer or your file system, read or write ChatGPT memories, access saved passwords, or use autofill data.
> 
> Browsing activity: Pages ChatGPT visits in agent mode are not added to your browsing history.”

Agentic AI browsers like OpenAI’s Atlas face a fundamental security challenge: separating real user intent from injected, potentially malicious instructions. They often fail because they interpret any instructions they find as user prompts. Without stricter input validation and more robust boundaries, these tools remain highly vulnerable to prompt injection attacks—with potentially severe consequences for privacy and data security.

**We don’t just report on privacy—we offer you the option to use it.**

Privacy risks should never spread beyond a headline. Keep your online privacy yours by using Malwarebytes Privacy VPN.

 OpenAI&#8217;s Atlas browser leaves the door wide open to prompt injection 

No, Gmail wasn’t hacked. But a flood of old stolen credentials on the dark web sparked headlines suggesting otherwise. Here’s what really happened.

After a misinterpretation of an interview with a security researcher, several media outlets hinted at a major Gmail breach.

Reporters claimed the incident took place in April. In reality, the researcher had said there was an enormous amount of Gmail usernames and passwords circulating on the dark web.

Those are two very different things. The credentials probably stem from a great many past attacks and breaches over the years.

But the rumors spread quickly—enough that Google felt it had to deny that their Gmail systems had suffered a breach.

> “The inaccurate reports are stemming from a misunderstanding of infostealer databases, which routinely compile various credential theft activity occurring across the web. It’s not reflective of a new attack aimed at any one person, tool, or platform.”

What happens is that cybercriminals buy and sell databases containing stolen usernames and passwords from data breaches, information stealers, and phishing campaigns. They do this to expand their reach or combine data from different sources to create more targeted attacks.

The downside for them is that many of these credentials are outdated, invalid, or linked to accounts that are no longer in use.

The downside for everyone else is that misleading reporting like this causes panic where there’s no need for it—whether it stems from misunderstanding technical details or from the pressure to make a headline.

Still, it’s always smart to check whether your email address has been caught up in a breach.

You can use our Digital Footprint scanner to see if your personal information is exposed online and take steps to secure it. If you find any passwords that you still use, change them immediately and enable multi-factor authentication (2FA) for those accounts wherever possible.

**We don’t just report on data privacy—we help you remove your personal information**

Cybersecurity risks should never spread beyond a headline. With Malwarebytes Personal Data Remover, you can scan to find out which sites are exposing your personal information, and then delete that sensitive data from the internet.

 Gmail breach panic? It’s a misunderstanding, not a hack 

“I don’t think a chip bag should be mistaken for a gun,” said the student, as eight police cars showed up to take down him and his Doritos.

An artificial intelligence (AI) detection system at Kenwood High School mistakenly flagged a student’s bag of potato chips as a gun, triggering a police response.

The 16-year-old had finished eating a bag of Doritos and crumpled it up in his pocket when he was done. But the school’s AI-based gun detection system mistook the crumpled foil for a firearm.

Moments later, multiple police cars arrived with officers drawing their weapons, dramatically escalating what should have been a non-event.

The student recalls:

> “Police showed up, like eight cop cars, and then they all came out with guns pointed at me talking about getting on the ground. I was putting my hands up like, ‘what’s going on?’ He told me to get on my knees and arrested me and put me in cuffs.”

Systems like these scan images or video feeds for the shape and appearance of weapons. They’re meant to reduce risk, but they’re only as good as the algorithms behind them and the human judgment that follows.

Superintendent Dr. Myriam Rogers told reporters:

> “The program is based on human verification and in this case the program did what it was supposed to do which was to signal an alert and for humans to take a look to find out if there was cause for concern in that moment.”

While we understand the need for safety measures against guns on school grounds, this could have been handled better. Eight police cars arriving at the scene and officers with guns drawn will certainly have had an impact on the students who witnessed it, let alone the student that was the focus of their attention.

As school principal Kate Smith said:

> “We understand how upsetting this was for the individual that was searched as well as the other students who witnessed the incident.”

AI safety tools are designed to protect students, but they do make mistakes, and when they fail, they can create the very fear they’re meant to prevent. Until these systems can reliably tell the difference between a threat and a harmless snack, schools need stronger guardrails—and a little more human sense.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 School&#8217;s AI system mistakes a bag of chips for a gun 

A global deal to fight cybercrime sounds sensible—but critics warn it could expand surveillance and criminalize researchers.

Around 70 countries have signed the new United Nations (UN) Convention against Cybercrime—the first global treaty designed to combat cybercrime through unified international rules and cooperation.

The treaty needs at least 40 UN member states to ratify it before it becomes international law. Once the 40th country does so, it will take another 90 days for the convention to become legally binding for all those who have joined.

Notably, the United States declined to sign. In a brief statement, a State Department spokesperson said:

> “The United States continues to review the treaty.”

And there is a lot to review. The convention has sparked significant debate about privacy, sovereignty, and how far law enforcement powers should reach. It was created in response to the rising frequency, sophistication, and cost of cybercrime worldwide—and the growing difficulty of countering it. As cyberattacks increasingly cross borders, international cooperation has become critical.

Supporters say the treaty closes legal loopholes that allow criminals to hide in countries that turn a blind eye. It also aims to solve miscommunication by establishing common definitions of cybercrimes, especially for threats like ransomware, online fraud, and child exploitation.​

But civil rights and digital privacy advocates argue that the treaty expands surveillance and monitoring powers, in turn eroding personal freedoms, and undermines safeguards for privacy and free expression.

Cybersecurity experts fear it could even criminalize legitimate research.

Katitza Rodriguez, policy director for global privacy at the Electronic Frontier Foundation (EFF) stated:

> “The latest UN cybercrime treaty draft not only disregards but also worsens our concerns. It perilously broadens its scope beyond the cybercrimes specifically defined in the Convention, encompassing a long list of non-cybercrimes.”

The Foundation for Defense of Democracies (FDD) goes even further, arguing that the treaty could become a platform for authoritarian states to advance ideas of state control over the internet, draw democratic governments into complicity with repression, and weaken key cybersecurity tools on which Americans depend.

> “Russia and China are exporting oppression around the world and using the United Nations as legal cover.”

Even Microsoft warned that significant changes would need to be made to the original draft before it could be considered safe:

> “We need to ensure that ethical hackers who use their skills to identify vulnerabilities, simulate cyberattacks, and test system defenses are protected. Key criminalization provisions are too vague and do not include a reference to criminal intent, which would ensure activities like penetration testing remain lawful.”

Those changes never came to life. Many observers now say the treaty creates a legal framework that allows monitoring, data storage, and cross-border information sharing without clear data protection. Critics argue it lacks strong, explicit safeguards for due process and human rights, particularly when it comes to cross-border data exchange and extradition.

When you think about it, the idea of having a global system to counter cybercriminals makes sense—criminals don’t care about borders, and the current patchwork of national laws only helps them hide. But to many, the real problem lies in how the treaty defines cybercrime and what governments could do in its name.

**We don’t just report on privacy—we offer you the option to use it.**

Privacy risks should never spread beyond a headline. Keep your online privacy yours by using Malwarebytes Privacy VPN.

Source

Malwarebytes